WordPress Site Hacks Continue

WordPress installations sporting known vulnerabilities continue to be compromised by hackers and turned into distributed denial of service (DDoS) launch pads.

That warning was sounded last week after IT professional Steven Veldkamp shared an intrusion prevention system (IPS) log with Hacker News, which found that a single 26-second DDoS attack against a site run by Veldkamp was launched from 569 different WordPress blogs. Those blogs appear to have been compromised by attackers, since they comprised everything from a "mercury science and policy" blog at the Massachusetts Institute of Technology (which as of press time remained offline) and a National Endowment for the Arts blog to WordPress sites run by Pennsylvania State University and Stevens Institute of Technology.

"The key aspect to note here is the number of compromised WordPress servers," said Stephen Gates, chief security evangelist at DDoS defense firm Corero Network Security, via email. "It's a simple mathematical equation -- attackers are looking to infect servers sitting in hosting environments with each server easily capable of generating 1 Gbps of attack traffic. It is quite easy to generate extremely high volumes and varieties of attack traffic by compromising just a few WordPress servers."

Once WordPress servers get compromised, attackers can use them for a variety of purposes, such as attacking U.S. financial institutions. "From volumetric attacks that melt down firewalls to the 'low and slow attacks' that sneak through firewalls undetected -- the list is really endless," Gates said.

WordPress blogs, of course, are easy to provision and host. But that ease of installation -- and use -- means that such software is often run outside the purview of IT provisioning and oversight. Furthermore, many WordPress administrators fail to keep their software updated or follow security best practices, such as choosing unique usernames and strong passwords for WordPress admin accounts. As a result, numerous WordPress sites sporting known vulnerabilities -- or "admin" as the admin account name -- remain sitting ducks for automated attacks.

Indeed, malware is often used to automatically find and exploit vulnerable WordPress installations. In August, Matthew Bing, an Arbor Security Engineering & Response Team (ASERT) research analyst, noted that the Fort Disco malware -- first discovered in April 2013 -- was being used to target known vulnerabilities in content management systems, backed by six command-and-control servers that were running a botnet comprised of more than 25,000 Windows PCs. "To date, over 6,000 Joomla, WordPress and Datalife Engine installations have been the victims of password guessing," he said in a blog post.

How widespread is the problem of exploitable WordPress software? According to a study conducted by EnableSecurity CEO Sandro Gauci, the list of the one million most trafficked websites -- per the Alexa index -- includes 40,000 WordPress sites. But 70% of those sites are running a version of WordPress with known vulnerabilities.

Those statistics were relayed last week by WordPress security expert Robert Abela, who studied data that EnableSecurity's Gauci compiled over a four-day period in the middle of September, immediately following the September 11 release of WordPress 3.6.1, which remains the latest version.

In a blog post, Abela reported that of the 42,106 WordPress sites from the Alexa index identified, 19% had already been updated to the new version, while 31% of sites were still running the previous version (3.6). But the remaining 51% of cataloged WordPress sites ran one of 72 other versions, with 2% of all cataloged sites still running version 2.x, which dates from 2007 and earlier.

Needless to say, many historical WordPress updates have included patches for exploitable vulnerabilities. For example, the latest version of WordPress -- 3.6.1 -- patched a known vulnerability in version 3.6 that would have allowed an attacker to remotely execute code. Previous versions of WordPress have also sported a number of known bugs, including version 3.5.1 (8 vulnerabilities), 3.4.2 (12 vulnerabilities) and 3.3.1 (24 vulnerabilities).

All of this adds up to numerous WordPress sites that can be relatively easily hacked, based on a review of the top 10 most-seen versions of WordPress seen among the more than 40,000 counted by Gauci. "At least 30,823 WordPress websites out of 42,106 are vulnerable to exploitable vulnerabilities," said Abela. "This means that 73.2% of the most popular WordPress installations are vulnerable to vulnerabilities which can be detected using free automated tools. Considering the number of vulnerable WordPress installations out there, and the popularity of such websites, we are still surprised ... most of them haven't been hacked yet."

Great article Mathew. The average small business owner does not have the time or staff do keep their WordPress websites up to date. That is why I created a complete WordPress monitoring and maintenance service called WP-MONITOR http://www.wp-monitor.com/ we we take care of all of these vulnerabilities on WordPress sites for the clients. Not only do we take care of the security, but we also provide Daily WordPress Backup, Plugin Updates, Uptime Monitoring, Traffic Reports, Broken Links reports, Security Scanning, Malware removal, Theme Changes, more features than any other WordPress Monitoring plan.

I wonder what the NSA will make of my Pictures posted ( Altered Photos of Hitler performing Stupid Magic tricks and other Dada/Surrealist rants raves and absurdity, They'll probably think it's some Code for something and since I post my Beliefs as "Anarcho-Surrealist", which means Nothing. I mean the header of one of my blogs is " A Hobo with a Jar of Mustard", and the other is "How can I disturb your sense of Reality today?" Anyway, I think all American should set up a an Identical blog, that streams 24/7 webcam shots of Toasters, or Toilets, or the inside of an old boot in a ditch..

I agree with Mr Carr - get the site hosted by WordPress or another professional host that will ensure the software is kept up to date. Too many businesses try to take these responsibilities upon themselves, but don't really have the skills or resources to do it really well. The issue isn't just the vulnerabilities they introduce for their own businesses, it's the fact that they become effectively complicit in creating issues for others, too. While not as loathsome, it's rather like drunk driving, where the potential victim(s) is not likely to be only the driver.

If you can't take responsibility for keeping the software up to date, consider whether hosting with WordPress.com is practical for your purposes. You can pay to upgrade from the free service to one associated with your domain and then let their webmonkeys worry about software patches.

Published: 2015-03-03Off-by-one error in the ecryptfs_decode_from_filename function in fs/ecryptfs/crypto.c in the eCryptfs subsystem in the Linux kernel before 3.18.2 allows local users to cause a denial of service (buffer overflow and system crash) or possibly gain privileges via a crafted filename.

Published: 2015-03-03** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue in customer-controlled software. Notes: none.

How can security professionals better engage with their peers, both in person and online? In this Dark Reading Radio show, we will talk to leaders at some of the security industry’s professional organizations about how security pros can get more involved – with their colleagues in the same industry, with their peers in other industries, and with the IT security community as a whole.